Update to 3.0.7 via composer does nothing

Still no luck: please, see output of both commands:

@:/www/html$ <strong>composer update drupal/o365</strong>
Loading composer repositories with package information
Updating dependencies
Nothing to modify in lock file
Installing dependencies from lock file (including require-dev)
Nothing to install, update or remove
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package doctrine/reflection is abandoned, you should avoid using it. Use roave/better-reflection instead.
Package twig/extensions is abandoned, you should avoid using it. No replacement was suggested.
Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.
Generating autoload files
Hardening vendor directory with .htaccess and web.config files.
71 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
Cleaning installed packages.

@:/www/html$ <strong>composer update drupal/o365 --with-dependencies</strong>
Loading composer repositories with package information
Dependency drupal/externalauth is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency drupal/oauth2_client is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Info from https://repo.packagist.org: #StandWithUkraine
Updating dependencies
Lock file operations: 0 installs, 1 update, 0 removals
  - Upgrading microsoft/microsoft-graph (1.56.0 => 1.57.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 1 update, 0 removals
  - Downloading microsoft/microsoft-graph (1.57.0)
  - Upgrading microsoft/microsoft-graph (1.56.0 => 1.57.0): Extracting archive
Package container-interop/container-interop is abandoned, you should avoid using it. Use psr/container instead.
Package doctrine/reflection is abandoned, you should avoid using it. Use roave/better-reflection instead.
Package twig/extensions is abandoned, you should avoid using it. No replacement was suggested.
Package webmozart/path-util is abandoned, you should avoid using it. Use symfony/filesystem instead.
Generating autoload files
Hardening vendor directory with .htaccess and web.config files.
71 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
Cleaning installed packages.

That's what is in my composer.json

"drupal/o365": "^3.0",

Think I found the problem:

<strong>composer require 'drupal/o365:^3.0.8'</strong>
./composer.json has been updated
Running composer update drupal/o365
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires drupal/o365 ^3.0.8 -> satisfiable by drupal/o365[3.0.8, 3.0.x-dev].
    - drupal/o365[3.0.8, ..., 3.0.x-dev] require drupal/externalauth ^2.0 -> found drupal/externalauth[dev-2.0.x, 2.0.0, 2.0.x-dev (alias of dev-2.0.x)] but it conflicts with your root composer.json require (^1.4).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.

But: I could not upgrade externalauth to 2.0 because o365 3.0.6 was present. And I could not upgrade o365 because it externalauth 1.4 was present...

Problem 1
    - Root composer.json requires drupal/externalauth ^2.0, found drupal/externalauth[dev-2.0.x, 2.0.0, 2.0.x-dev] but these were not loaded, likely because it conflicts with another require.
  Problem 2
    - d<strong>rupal/o365 is locked to version 3.0.6</strong> and an update of this package was not requested.
    - drupal/o365 3.0.6 requires drupal/externalauth ^1.3 -> found drupal/externalauth[dev-1.x, 1.3.0, 1.4.0, 1.x-dev (alias of dev-1.x)] but it conflicts with your root composer.json require (^2.0).

Had to composer remove drupal/o365
and re-require.

This was not a problem for me, because the modules were not activate.
I just wonder what someone looses in terms of configuration, when trying to update from the locked externalauth 1.3 to 2.0 and having to uninstall the entire o365.